Many security systems rely on digital certificates or “keys” for encryption and authentication of a message. The terms “key,” “main key,” “certificate,” and “digital certificate” are used interchangeably throughout this document and can mean a digital credential which includes a public key, for encrypting information directed to the user of the key and information for authenticating the user.
Some security systems, such as Pretty Good Privacy (PGP), do not implement a centralized authority (which keeps the most up to date status of all keys on that system, and distributes certificate revocation lists, indicating which certificates have been revoked). Instead, PGP implements “a web of trust,” a method where other entities, other than a centralized authority, authenticate the keys by “signing” them. Other users may or may not consider a key authentic depending on the combination of entities which signed a given key.
PGP allows keys to be stored on key servers. The owner of a key may change the status of his key on a server, for example, the owner may revoke the key. Also other users may change the status of the key by signing it or removing their signature. A user on such system who has obtained a key of another user from the server for the purposes of encryption and authentication, has to manually download and verify the key to determine that it has not been revoked by the owner and that it can still be trusted based on combination of signatures associated with it.